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FAILSAFE PROGRAMMING OF IMPLANTABLE MEDICAL DEVICES 

[0001] This application claims priority from U.S. Provisional Application Serial No. 
60/422,259, filed October 31, 2002, and U.S. Provisional Application Serial No. 60/503,224, 
filed September 15, 2003. The entire content of both Provisional Applications is 
incorporated herein by reference. 

TECHNICAL FIELD 
[0002] The invention relates to medical devices, and more particularly, to programming of 
implantable medical devices. 

BACKGROUND 

[0003] A variety of types of implantable medical devices are used to deliver therapies to 
patients. For example, implantable pulse generators are used to deliver neurostimulation and 
cardiac pacing therapies to patients. As another example, implantable pumps are used to 
deliver therapeutic agents to patients. 

[0004] Typically, a clinician uses a programming device, e.g., a clinician programmer, to 
program aspects of the operation of an implantable medical device after it has been implanted 
in a patient. Programming devices are computing devices capable of communicating with 
implantable medical devices through patient body tissue via device telemetry. To facilitate 
communication with an implantable medical device, a programming device may be coupled 
to a programming head that is placed on the surface of the patient at a position proximate to 
location of the implantable medical device within the patient. 

[0005] A trend in the implantable medical device arts is the ever-increasing complexity of the 
devices themselves, and the firmware that controls the operation of the devices. For 
example, many modern implantable medical devices provide a variety of therapy delivery 
and/or patient monitoring modes, which may be selected and configured by the clinician 
during a programming session. During a programming session, the clinician may also need 
to select values for a variety of programmable parameters, threshold values, or the like, that 
control aspects the delivery of therapy. 
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[0006] Consequently, programming devices, and more particularly the software that allows a 
clinician to select modes and/or values for programmable parameters, have become 
increasingly complex. Programming sessions may involve trial-and-error testing of various 
modes and/or parameter values. In some cases, a programming session may be automated or 
semi-automated, e.g., conducted by a clinician or patient, with an algorithm executed by the 
programming device controlling at least some of the selection of new modes and/or 
parameter values to test. Such testing requires frequent telemetry communication between 
the programming device and the implantable medical device as new modes and/or parameters 
selected by the clinician, the patient, or an algorithm are communicated from the 
programming device to the implantable medical device. 

[0007] It is possible for the complex programming software executed by programming 
devices to have hidden failure modes that do not become apparent, even with extensive 
validation and testing. It is also possible for the physical cable between a programming 
device and a telemetry head, the telemetry head itself, or the RF telemetry link between the 
programming device and the implantable medical device to fail. If one or more such failures 
occur during a programming session, e.g., during communication of a new mode or new 
parameter values to the implantable medical device, the incomplete and/or inaccurate transfer 
of data may leave the implantable medical device operating in an undesirable and potentially 
unsafe configuration. Moreover, because of the failure of communication between the 
programming device and the implantable medical device, a clinician may be left with no 
immediate means to remove the implantable medical device from the unsafe condition. 

SUMMARY 

[0008] In general, the invention is directed toward techniques for failsafe programming of 
implantable medical devices (IMDs). A watchdog unit receives stay-alive signals from a 
programming device during programming of an IMD. The watchdog unit maintains a 
watchdog timer, and resets the timer upon receipt of each stay-alive signal. If the watchdog 
timer expires, the watchdog unit changes a mode of operation of the implantable device, e.g., 
places the implantable medical device into a known, safe state, to avoid the IMD being left in 
an undesirable and potentially unsafe state with no immediate means to remove it from such 
a state. For example, the watchdog unit may cause the implantable medical device to 
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suspend delivery of therapy, perform a power-on reset, and/or recall a known, safe, therapy 
delivery program. 

[0009] The watchdog unit may be located on a cable that connects the programming device 
to a telemetry head used to communicate with the IMD, may couple the cable to the 
telemetry head, may be located within the telemetry head, or may be located within the IMD. 
Consequently, in some embodiments, the stay-alive signals may be active transitions of a 
data line of the data cable, or wireless telemetry signals. The watchdog unit may be 
embodied as hardware, a software module, or a combination of hardware and software. 
[0010] In one embodiment, the invention is directed to a method in which stay-alive signals 
are received from a programming device during the course of a wireless telemetry session 
between the programming device and an IMD, and a watchdog timer is reset in response to 
receipt of each of the stay-alive signals. A mode of operation of the IMD is changed in 
response to expiration of the watchdog timer. 

[0011] In another embodiment, the invention is directed to a device that includes a telemetry 
circuit and a processor. The processor receives stay-alive signals from a programming 
device during the course of a wireless telemetry session between the programming device 
and an IMD, and resets a watchdog timer in response to receipt of each of the stay-alive 
signals. The processor sends a signal to the IMD via the telemetry circuit to change a mode 
of operation of the IMD in response to expiration of the watchdog timer. 
[0012] In another embodiment, the invention is directed to an IMD that includes a telemetry 
circuit and a watchdog unit. The watchdog unit receives stay-alive signals from a 
programming device via the telemetry circuit during the course of a wireless telemetry 
session between the programming device and the IMD, and resets a watchdog timer in 
response to receipt of each of the stay-alive signals. The watchdog unit changes a mode of 
operation of the IMD in response to expiration of the watchdog timer. 
[0013] In another embodiment, the invention is directed to a computer-readable medium 
containing instructions. The instructions cause a programmable processor to receive stay 
alive signals from a programming device during the course of a wireless telemetry session 
between the programming device and an IMD, reset a watchdog timer in response to receipt 
of each of the stay-alive signals, and change a mode of operation of the IMD in response to 
expiration of the watchdog timer. 
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[0014] In another embodiment, the invention is directed to a method in which programming 
signals that affect the operation of an IMD are sent to the IMD via wireless telemetry during 
a programming operation, and stay-alive signals are sent to a watchdog unit during the 
programming operation to allow the watchdog unit to detect failure of a wireless telemetry 
session between a programming device and the IMD during the programming operation. 
[0015] In another embodiment, the invention is directed to a programming device that 
includes a telemetry circuit and a processor. The processor sends programming signals that 
affect the operation of an IMD to the IMD via the telemetry circuit during a programming 
operation, and sends stay-alive signals to a watchdog unit during the programming operation 
to allow the watchdog unit to detect failure of a wireless telemetry session between the 
programming device and the IMD during the programming operation. 
[0016] In another embodiment, the invention is directed to a computer-readable medium 
containing instructions. The instructions cause a programmable processor to send 
programming signals that affect operation of an IMD to the IMD via wireless telemetry 
during a programming operation, and send stay-alive signals to a watchdog unit during the 
programming operation to allow the watchdog unit to detect failure of a wireless telemetry 
session between a programming device and the IMD during the programming operation. 
[0017] The invention may provide advantages. For example, a watchdog unit according to 
the invention may quickly remove an IMD from an undesirable and unsafe state caused by a 
failure during programming of the IMD. By maintaining a watchdog timer and resetting the 
watchdog timer upon receipt of stay-alive signals, a watchdog unit according to the invention 
may detect hardware or software failures of the programming device, and failure of the cable 
that couples the programming device to the telemetry head. In embodiments where the 
watchdog unit is located within the IMD, which are preferred, the watchdog unit may 
additionally detect failure of the telemetry head, the radio-frequency telemetry connection 
between the telemetry head and the IMD, and telemetry circuitry of the IMD. However, 
embodiments wherein the watchdog unit is located outside the IMD may advantageously be 
used during programming of existing IMDs. 

[0018] The details of one or more embodiments of the invention are set forth in the 
accompanying drawings and the description below. Other features, objects, and advantages 
of the invention will be apparent from the description and drawings, and from the claims. 



4 



PATENT 

Docket No.: 1023-227US01 /P-l 1555.00 



BRIEF DESCRIPTION OF DRAWINGS 

[0019] FIG. 1 is a conceptual diagram illustrating a system in which an example implantable 
medical device is programmed using failsafe programming techniques according to the 
invention. 

[0020] FIG. 2 is a block diagram further illustrating the system of FIG. 1 according to an 
embodiment of the invention in which the system includes a watchdog unit that facilitates 
failsafe programming of the implantable medical device of FIG. L 

[0021] FIG. 3 is a block diagram further illustrating the watchdog unit of FIG. 2 according to 
an embodiment of the invention. 

[0022] FIG. 4 is a block diagram illustrating the implantable medical device of FIG. 1 
according to an embodiment of the invention in which the implantable medical device 
includes a watchdog unit. 

[0023] FIG. 5 is a block diagram illustrating an exemplary programming device that 

facilitates failsafe programming of the implantable medical device of FIG. 1. 

[0024] FIG. 6 is a flow diagram illustrating exemplary operation of the programming device 

of FIG. 5 to facilitate failsafe programming of the implantable medical of FIG. 1. 

[0025] FIG. 7 is a flow diagram illustrating exemplary operation of the watchdog unit of FIG. 

3 to facilitate failsafe programming of the implantable medical device of FIG. 1. 

DETAILED DESCRIPTION 

[0026] FIG. 1 is a conceptual diagram illustrating a system 10 in which an example 
implantable medical device (IMD) 12 is programmed using failsafe programming techniques 
according to the invention. IMD 12 is shown in FIG. 1 implanted within a patient 14. In the 
illustrated embodiment, IMD 12 takes the form of an implantable neurostimulator (INS) that 
delivers neurostimulation therapy to patient 12 via leads 16A and 16B (hereinafter "leads 
16"). 

[0027] Specifically, in the illustrated configuration, leads 16 are implanted proximate to the 
spinal cord 18 of patient 14, and IMD 12 delivers spinal cord stimulation (SCS) therapy to 
patient 14 in order to, for example, reduce pain experienced by patient 14. Leads 16 include 
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electrodes (not shown in FIG. 1), and IMD 12 delivers neurostimulation to spinal cord 18 via 
the electrodes. IMD 12 may be an implantable pulse generator, and may deliver 
neurostimulation to spinal cord 1 8 in the form of electrical pulses. 

[0028] IMD 12 delivers neurostimulation according to a program. The program may include 
values for a number of parameters, and the parameter values define the neurostimulation 
therapy delivered according to that program. In embodiments where IMD 12 delivers 
neurostimulation therapy in the form of electrical pulses, the parameters may include voltage 
or current pulse amplitudes, pulse widths, pulse rates, and the like. Further, the parameters 
for a program include information identifying which electrodes have been selected for 
delivery of pulses according to the program, and the polarities of the selected electrodes. 
[0029] System 10 also includes a programming device 20. Programming device 20 may, as 
shown in FIG. 1, be a handheld computing device. Programming device 20 includes a 
display 22, such as a LCD or LED display, to display information to a user. Programming 
device 20 may also include a keypad 24, which may be used by a user to interact with 
programming device 20. In some embodiments, display 22 may be a touch screen display, 
and a user may interact with programming device 20 via display 22. A user may additionally 
or alternatively interact with clinician programmer 20 using peripheral pointing devices, such 
as a stylus or mouse. Keypad 24 may take the form of an alphanumeric keypad or a reduced 
set of keys associated with particular functions. 

[0030] A clinician (not shown) may use programming device 20 to program 
neurostimulation therapy for patient 12. In some embodiments, the clinician specifies 
programs by selecting program parameter values, and tests the specified programs on patient 
12. In other embodiments, programming device 20 provides an automated or semi- 
automated programming routine in which programming device 20 generates programs and 
tests the generated programs on patients. In such embodiments, either or both of the clinician 
and patient 14 may interact with programming device 20 during testing of the generated 
programs. Further, in such embodiments, the clinician may interact with programming 
device 20 to confirm programs generated by programming device 20 for testing, and/or to 
select programs from among those automatically tested by programming device. An 
exemplary programming device that provides a semi-automated programming routine is 
described in U.S. Patent No. 6,308,102, issued to Sieracki et al. 
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[0031] In either case, programming device 20 sends each of the programs to be tested to 
IMD 12 using radio-frequency telemetry techniques known in the art. For example, 
programming device 20 may send program parameters as commands, and may send other 
commands necessary to effect reprogramming of IMD 12 via device telemetry. IMD 12 
receives and decodes the commands, and stores the program parameters in registers, or the 
like, for use in defining the neurostimulation delivered to patient 14 according to that 
program. Programming device 20 is coupled to a telemetry head 26 via cable 28, and head 
26 is placed in proximity to IMD 12 to facilitate telemetry communication between 
programming device 20 and IMD 12. 

[0032] Programming device 20 sends a number of commands to IMD 12 to reprogram IMD 
12 for each program tested during the programming session. In conventional systems, if 
IMD 12, cable 28, or telemetry head 26 were to fail during the transmission of commands 
necessary to reprogram IMD 12 for testing of a program, IMD 12 could be left in an 
undesirable or potentially dangerous state, e.g., could deliver undesirable or potentially 
dangerous neurostimulation according to an incomplete program. Moreover, in conventional 
systems, because IMD 12, cable 28, or head 26 had failed, the clinician and/or patient 14 
might be left with no immediate means to remove IMD 12 from the undesirable or 
potentially dangerous state. 

[0033] System 10, in accordance with the invention, includes a watchdog unit (not shown). 
The watchdog unit and programming device 20 provide for failsafe programming of IMD 12, 
as will be described in greater detail below. The watchdog unit may be embodied as a 
hardware device, as a software algorithm stored within a computer-readable medium and 
executed by a processor, or as a combination of hardware and software. 
[0034] The watchdog unit may be located, for example, within telemetry head 26 or along 
cable 28. In some embodiments, the watchdog unit may couple cable 28 to head 26. In other 
embodiments, the watchdog unit is located within or provided by IMD 12. 
[0035] FIG. 2 is a block diagram further illustrating system 10 according to an embodiment 
of the invention. As discussed above, system 10 includes IMD 12, and programming device 
20 coupled to telemetry head 26 by cable 28. System 10 further includes a watchdog unit 40, 
which in the illustrated embodiment couples cable 28 to head 26. 
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[0036] During a programming session, watchdog unit 40 maintains a watchdog timer. 
Programming device 20 sends stay-alive signals to watchdog unit 40 via cable 28 to indicate 
that programming device 20 is functioning properly, and watchdog unit 40 resets the 
watchdog timer in response to each of the stay-alive signals. In the event that watchdog unit 
40 fails to receive a stay-alive signal before the watchdog timer expires, watchdog unit 40 
sends one or more commands to IMD 12 via telemetry head 26 to change a mode of 
operation of IMD 12, e.g., to place IMD 12 in a known, safe state. 

[0037] For example, watchdog unit 40 may send a command to IMD 12 to cause IMD 12 to 
stop delivering therapy and/or perform a power-on reset (POR). In some embodiments, 
watchdog unit 40 or IMD 12 stores a known, safe neurostimulation therapy program. In such 
embodiments, watchdog unit 40 may provide the program to IMD 12, or send a command to 
IMD 12 to cause IMD 12 to recall the program for delivery of neurostimulation therapy 
according to the program. 

[0038] Programming device 20 sends a stay-alive signal to watchdog unit 40 periodically 
such that watchdog unit 40 receives a stay-alive signal before the watchdog timer expires. In 
exemplary embodiments, the stay-alive signals comprise transitions on one or more data lines 
of cable 28 that couple programming device 20 to watchdog unit 40. By requiring stay-alive 
signals to be active transitions on one or more data lines rather than passive hardware 
handshaking lines, watchdog unit 40 may avoid erroneously resetting the watchdog timer in 
situations where programming device 20 has failed but continues to generate the passive 
signal, e.g. the signal is "locked in" by failure of programming device 20. Programming 
device 20 may provide stay-alive signals upon execution of instructions of control software 
of programming device 20 that is used for transmission of programming commands to IMD 
12, rather than as part of an independent thread or process, so that programming device 20 
Hoes not continue to signal that it is operating properly despite the fact that the control 
software has failed. 

[0039] Watchdog unit 40 receives signals, e.g., programming commands, from programming 
device 20 via cable 28 during a programming operation, e.g., a reprogramming of IMD 12 
with a new program to test during a programming session, that are provided to telemetry 
head 26 for transmission to IMD 12. In exemplary embodiments, the signals are transitions 
on one or more data lines of cable 28 that couple programming device 20 to watchdog unit 
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40. In some embodiments, watchdog unit 40 resets the watchdog timer upon receipt of both 
programming signals and stay-alive signals, and programming device 20 provides dedicated 
stay-alive signals such that watchdog unit 40 receives either a programming signal or stay- 
alive signal before the watchdog timer expires. Programming device 20 may send 
programming signals and stay-alive signals on common or separate data lines of cable 28. 
[0040] As described above, a programming session may include multiple programming 
operations, e.g., IMD 12 may be reprogrammed a number of times to test a number of 
programs. Further, the programming session may include a period between programming 
operations where non-critical communication, or no communication, between programming 
device 20 and IMD 12 is taking place. In order to avoid delivery of stay-alive signals and 
maintenance of the watchdog timer during periods between programming operations, e.g., 
non-critical periods, programming device 20 may only deliver stay-alive signals during 
programming operations, and may signal the beginnings and ends of programming operations 
to watchdog unit 40 to cause watchdog unit to maintain the watchdog timer only during the 
programming operations. 

[0041] As described above, watchdog unit 40 maintains the watchdog timer to detect 
hardware or software failures of programming device 20, and place IMD 12 in a safe state in 
response to such a failure. Further, because the watchdog timer will also expire if cable 28 
fails, watchdog unit 40 will detect a failure of cable 28, and place IMD 12 in a safe state in 
response to such a failure. 

[0042] FIG. 3 is a block diagram further illustrating watchdog unit 40 according to an 
embodiment of the invention. As illustrated in FIG. 3, watchdog unit 40 includes a processor 
50 that controls watchdog unit 40 to provide the functionality attributed to watchdog unit 40 
herein. Processor 50 maintains the watchdog timer as described above, and receives 
programming signals and stay-alive signals from programming device 20 via one or more 
data lines of cable 28. 

[0043] Watchdog unit 40 may include a telemetry circuit 52 that enables communication 
between watchdog unit 40 and IMD 12 (FIG. 1). Upon expiration of the watchdog timer, 
processor 50 sends a command to IMD 12 via telemetry circuit 52 and telemetry head 26 
(FIG. 1) to change a mode of operation of IMD 12, e.g., to place IMD 12 in a known, safe 
state. As described above, the command may cause IMD 12 to suspend delivery of therapy, 
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perform a POR, and/or recall a stored program. In some embodiments, upon expiration of 
the watchdog timer, processor 50 sends a program stored in a memory 54 to IMD 12 via 
telemetry circuit 52 and head 26 to cause IMD 12 to deliver therapy according to the 
program. During "normal" operation, e.g., when the watchdog timer has not expired, 
processor 50 sends programming signals received from programming device 20 to IMD 12 
via telemetry head 26. 

[0044] In exemplary embodiments, watchdog unit 40 receives power for operation from 
programming device 20 via cable 28. In such embodiments, watchdog unit 40 may also 
include an auxiliary power source 56. In the event that processor 50 detects a failure in the 
delivery of power from programming device 20, which may be caused by a hardware failure 
of device 20 or a failure of cable 28, processor 50 may activate auxiliary power source 56 
and send a command to IMD 12 via telemetry circuit 54 to change a mode of operation of 
IMD 12. 

[0045] Auxiliary power source 56 may be, for example, a rechargeable battery or capacitive 
element. In some embodiments, auxiliary power source 56 need only store enough power to 
allow processor 50 to send a command to IMD 12 to place IMD 12 in a known, safe state. 
Further, the invention is not limited to embodiments where watchdog unit 40 receives 
primary power from programming device 20, but instead includes embodiments where 
watchdog unit 40 houses a primary power source, such as a rechargeable or non-rechargeable 
battery. 

[0046] In some embodiments, watchdog unit 40 provides an emergency shutdown circuit 58, 
which may be activated by a user, such as the clinician or patient 14 (FIG. 1). Upon 
activation of emergency shutdown circuit 58, processor 50 sends a command to IMD 12 via 
telemetry circuit 52 to cause IMD 12 to, for example, suspend delivery of therapy. 
Emergency slnrfdown circuit 58 may include, for example, a switch thaf is activated by the 
user pressing a button located on a housing of watchdog unit 40. 
[0047] Processor 50 may include one or more of a microprocessor, a controller, a digital 
signal processor (DSP), an application specific integrated circuit (ASIC), a field- 
programmable gate array (FPGA), discrete logic circuitry, or the like. Memory 54 may store 
program instructions that cause processor 50 to provide the functionality ascribed to it herein. 
Memory 54 may include one or more volatile, non- volatile, magnetic, optical, or electrical 
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media, such as read-only memory (ROM), random access memory (RAM), electrically- 
erasable programmable ROM (EEPROM), non- volatile RAM (NVRAM), flash memory, or 
the like. Memory 54 may include both on-board and off-board components. 
[0048] FIG. 4 is a block diagram illustrating IMD 12 according to an embodiment of the 
invention in which IMD 12 includes a watchdog unit 60. Like watchdog unit 40, watchdog 
unit 60 receives stay-alive signals from programming device 20, resets a watchdog timer in 
response to receipt of stay-alive signals, and changes a mode of operation of IMD 12 in 
response to expiration of the watchdog timer. Watchdog unit 60 located within IMD 12 may 
detect failure of telemetry head 26 (FIG. 1), loss of the RF telemetry link between 
programming device 20 and IMD 12, and failure of a telemetry circuit 62 of IMD 12 in 
addition to hardware or software failures of programming device 20 and failure of cable 28 
(FIG. 1). 

[0049] IMD 12 delivers neurostimulation therapy via electrodes 64A-D of lead 16A and 
electrodes 64E-H of lead 16B (collectively "electrodes 64"). Electrodes 64 may be ring 
electrodes. The configuration, type and number of electrodes 64 illustrated in FIG. 2 are 
merely exemplary. 

[0050] Electrodes 64 are electrically coupled to a therapy delivery circuit 66 via leads 16. 
Therapy delivery circuit 66 may, for example, include one or more output pulse generators, 
e.g., capacitive elements and switches, coupled to a power source such as a battery. Therapy 
delivery circuit 66 delivers electrical pulses to patient 14 via two or more of electrodes 64 
under the control of a processor 68. 

[0051] As described above, processor 68 controls therapy delivery circuit 66 to deliver 
neurostimulation therapy according to a program. Specifically, processor 68 may control 
circuit 66 to deliver electrical pulses with the amplitudes and widths, and at the rates 
specified by the program. Processor 68 may also control circuit 66 to deliver tKe pulses via a 
selected combination of electrodes 64, as specified by the program. 
[0052] As described above, IMD 12 may be reprogrammed a number of times during a 
programming session to test a number of programs. For each program tested, IMD 12 
receives a number of commands, including the program parameters, from programming 
device 20 via telemetry circuit 62 and watchdog unit 60. The program parameters are stored 
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within a memory 70 as the program used by processor 68 to control delivery of 
neurostimulation. 

[0053] Programming device 20 also sends stay-alive signals via RF device telemetry, which 
are received by watchdog unit 60 via telemetry circuit 62. Watchdog unit 60 may reset the 
watchdog timer upon receipt of each stay-alive signal, and may also reset the watchdog timer 
upon receipt of programming commands from programming device 20. In some 
embodiments, watchdog unit 60 also receives signals indicating the beginning and ending of 
a programming operation from programming device 20, and maintains the watchdog timer 
only during the indicated programming operations. 

[0054] Watchdog unit 60 changes a mode of operation of IMD 12, e.g., places IMD 12 into a 
known safe state, upon expiration of the watchdog timer. Watchdog unit 60 may, for 
example, cause IMD 12 to suspend delivery of therapy, perform a POR, and/or activate a 
known, safe program stored in memory 70. The functionality attributed to watchdog unit 60 
herein may be provided by processor 68, or by a separate processor. Where watchdog unit 60 
is embodied within a separate processor, watchdog unit 60 may signal expiration of the 
watchdog timer to processor 68 to cause processor 68 to change a mode of operation of IMD 
12 in any of the above-identified ways. 

[0055] Processor 68 and watchdog unit 60 may include one or more of a microprocessor, a 
controller, a DSP, an ASIC, an FPGA, discrete logic circuitry, or the like. Memory 70 may 
include program instructions that, when executed by processor 68 and watchdog unit 60, 
cause processor 68 and watchdog unit 60to perform the functions ascribed to processor 68 
and watchdog unit 60 herein. Memory 70 may include one or more volatile, non- volatile, 
magnetic, optical, or electrical media, such as RAM, ROM, NVRAM, EEPROM, flash 
memory, and the like. Memory 70 may include on-board and/or off-board components. 
[0056] FIG. 5 is a block diagram illustrating programming device 20 in greater detail/ 
Programming device 20 includes a processor 80 and a user interface 82 that allows a user, 
such as the clinician or patient 14, to interact with processor 80. User interface 82 may 
include display 22 and keypad 24 (FIG. 1), and allow the user to, for example, select 
programs to test during a programming session. 

[0057] Processor 80 may transmit programming signals, e.g., commands, to IMD 12 via a 
telemetry circuit 84 and telemetry head 26 (FIG. 1). Processor 80 also provides stay-alive 
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signals to a watchdog unit 40 via a data line of cable 28 (FIG. 1), or to a watchdog unit 60 via 
telemetry circuit 84 and telemetry head 26, as described above. Processor 80 sends the stay- 
alive signals periodically, such that the watchdog unit 40, 60 receives a stay-alive signal 
before the watchdog timer expires. 

[0058] In some embodiments, as described above, the watchdog unit 40, 60 resets the 
watchdog timer upon receipt of both programming signals and stay-alive signals, and 
processor 80 provides dedicated stay-alive signals such that the watchdog unit 40, 60 
receives with a programming signal or stay-alive signal before the watchdog timer expires. 
In exemplary embodiments, processor 80 provides stay- alive signals upon execution of 
instructions of control software of programming device 20. Further, in order to avoid 
delivery of stay-alive signals during period where there is no communication or non-critical 
communication with IMD 12, processor 80 may send signals to the watchdog unit 40, 60 
indicating the beginning and end of programming operations within a programming session, 
and may send stay-alive signals only during the programming operations. 
[0059] Processor 80 may include a microprocessor, a controller, a DSP, an ASIC, an FPGA, 
discrete logic circuitry, or the like. A memory 86 may include program instructions that, 
when executed by processor 80, cause programming device 20 to perform the functions 
ascribed to programming device 20 herein. Memory 86 may include any volatile, non- 
volatile, fixed, removable, magnetic, optical, or electrical media, such as a RAM, ROM, CD- 
ROM, hard disk, removable magnetic disk, memory cards or sticks, NVRAM, EEPROM, 
flash memory, and the like. 

[0060] FIG. 6 is a flow diagram illustrating exemplary operation of programming device 20 
to facilitate failsafe programming of IMD 12. Programming device 20 sends a signal 
indicating the beginning of a programming operation to a watchdog unit 40, 60 (90). During 
the programming operation, programming device 20 periodically sends stay-alive signals to 
the watchdog unit 40, 60 to cause the watchdog unit to reset a watchdog timer (92). In some 
embodiments, programming device 20 may only send dedicated stay-alive signals when no 
programming signal has been sent in time to cause the watchdog unit 40, 60 to reset the 
watchdog timer. When programming device 20 determines that the programming operation 
is done (94), programming device 20 sends a signal to the watchdog unit 40, 60 indicating 
the end of the programming operation (96). 
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[0061] FIG. 7 is a flow diagram illustrating exemplary operation of watchdog unit 40 to 
facilitate failsafe programming of IMD 12. Although FIG. 7 illustrates operation of 
watchdog unit 40, it is understood that watchdog unit 60, as described above, may perform 
many of the functions of watchdog unit 40. 

[0062] Watchdog unit 40 receives a signal indicating the start of a programming operation 
from programming device 20 via one or more data lines of cable 28 (100), and initializes a 
watchdog timer in response to the signal (102). Watchdog unit 40 monitors for failure of 
power delivery from programming device 20 (104), activation of an emergency shutdown 
circuit 58 by a user (106), a signal indicating the end of the programming operation from 
programming device 20 (108), and stay-alive signals from programming device 20 (110) 
during the programming operation. Each time watchdog unit 40 receives a stay-alive signal, 
and in some embodiments a programming signal, from programming device 20 before the 
watchdog timer expires, watchdog unit 40 resets the watchdog timer (112). 
[0063] If watchdog unit 40 does not receive a stay-alive signal or programming signal from 
programming device 20 before the watchdog timer expires (110), watchdog unit sends a 
signal to IMD 12 via telemetry head 26 to place IMD 12 in a known, safe state (116). The 
signal may cause IMD 12 to, for example, suspend delivery of therapy, perform a POR, 
and/or recall a known, safe therapy program. Watchdog unit 40 also sends such a signal to 
IMD 12 (126) if a user activates the emergency shutdown circuit 58 (106). In embodiments 
wherein watchdog unit 40 receives primary power from programming device 20, watchdog 
unit 40 activates an auxiliary power source 56 (114) and sends the signal to IMD 12(116) 
upon detection of a failure of power delivery by programming device 20 (1 04). When 
watchdog unit 40 receives a signal from programming device 20 indicating the end of the 
programming operation (108), watchdog unit 40 may stop maintaining the watchdog timer. 
[0064] Various embodiments of the invention have been described. However, one skilled in 
the art will recognize the various modifications may be made to the described embodiments 
without departing from the scope of the invention. For example, the invention is not limited 
to programming of spinal cord stimulation (SCS) therapy, or even to programming of 
neurostimulation therapy. The failsafe programming techniques described herein may be 
applied to the programming of any implantable medical device, such as pacemakers and 
implantable pumps. Moreover, the invention is not limited to failsafe programming of 
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implantable medical devices that deliver therapy, but may include failsafe programming of 
implantable medical devices used to monitor patients, such as implantable hemodynamic 
monitors or loop recorders. 

[0065] Further, although a programming device has been described herein primarily as a 
clinician programmer used to program therapy during a programming session, the invention 
is not so limited. A programming device that facilitates failsafe programming of an 
implantable medical device may a patient programmer used to control delivery of therapy by 
an implanted medical device in an ambulatory setting. For example, a patient programmer 
may be used to adjust program parameter for delivery of neurostimulation by an implantable 
medical device. These and other embodiments are within the scope of the following claims. 
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